SlackWiki - User contributions [en]

Category:Security:SSA

2012-01-31T10:53:36Z

Adrien: mozilla-thunderbird

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== mozilla-thunderbird (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird9, at LEAST:

Fixed in Thunderbird 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== seamonkey (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html#seamonkey2.6, at LEAST:

Fixed in SeaMonkey 2.6:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-01-31T10:49:13Z

Adrien: seamonkey

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== seamonkey (various issues, all versions impacted) ===

From http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html#seamonkey2.6, at LEAST:
Fixed in SeaMonkey 2.6:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-01-31T10:34:29Z

Adrien: Turn mozilla-* into mozilla-firefox; add _some_ know issues (those fixed in ff9)

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions vulnerable) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-01-31T10:21:39Z

Adrien: xap/mozilla-*: new; quick note

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-* ===
No specific CVE, you know they are vulnerable to at leas tone thing.

Category:Security:SSA

2012-01-31T07:33:18Z

Adrien: /* CVE-2011-2705 affected: current, 13.37 and all before */ - title: classify as "PRNG weakness"

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-31T07:29:48Z

Adrien: /* CVE-2011-4109 affected: current, 13.37 through 11.0 */ - title: add "unspecified impact"

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] (unspecified impact) affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-29T21:46:48Z

Adrien: /* CVE-2011-2939 (DDoS, affected: current and stable) */

Category:Security:SSA

2012-01-29T21:46:22Z

Adrien: d/perl: more detailled title (kind of vuln; affected slackware releases)

Category:Security:SSA

2012-01-29T21:06:24Z

Adrien: intro: explain the format for the CVEs on the page

Category:Security:SSA

2012-01-29T20:47:35Z

Adrien: d/perl: better formatting

Category:Security:SSA

2012-01-29T20:40:53Z

Adrien: /* perl */

Category:Security:SSA

2012-01-29T20:27:35Z

Adrien: d/perl: more detailled CVE

Category:Security:SSA

2012-01-29T20:05:13Z

Adrien: explain why we're not always giving specific CVEs all the time (hopeless software)

Category:Security:SSA

2012-01-29T19:30:22Z

Adrien: Rewrote introduction

List of security updates missing in 13 37

2012-01-29T18:10:20Z

Adrien: created

This page is meant to give a list of the packages which have known security issues in Slackware 13.37 and which haven't been updated yet.